Privacy Policy
Last updated: 8 October 2026
This policy explains how Pinoy Street Food collects, uses and protects your personal data when you visit our food stall at is-Suq tal-Belt, use our website www.pinoystreetfood.eu, order from us, contact us, apply for a job, or interact with our advertising and social media pages on Facebook and Instagram. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586).
1. Who we are
Pinoy Street Food is operated by Pinoy Street Food Limited, a company registered in Malta under number C 86283, with its registered office at Level 1, JL Building, 63 Luqa Road, Paola PLA 9045, Malta. Pinoy Street Food Limited is the data controller for the personal data described in this policy.
Food stall: is-Suq tal-Belt, Triq il-Merkanti, Valletta VLT 1175, Malta
Email: info@pinoystreetfood.eu
Phone: +356 2124 0349
2. The personal data we collect
Dietary and allergy information. If you tell us about an allergy or dietary requirement, we use it only to prepare your food safely. This can be health information, so we process it with your explicit consent, which you give by telling us. You can ask us to delete it at any time.
Contact form and emails. When you contact us we collect your name, email address, phone number, company (if given), and the content of your message.
Job applications. When you apply for a job we collect your CV, cover note and the contact and employment details you choose to send us.
Payments at our stall and self-ordering kiosk. Card payments are processed by our payment provider, Viva.com. We do not see or store your full card number. We keep a record of the transaction (amount, date, and the last digits of the card) for accounting purposes.
Website usage data. When you visit our website we and our partners collect technical information such as your IP address, browser and device type, pages visited, referring website, and actions you take, using cookies and similar technologies. See section 4 and our Cookie Policy.
Advertising and lead forms on Facebook and Instagram. If you respond to one of our ads, for example by completing an instant form (lead form) to request information or sign up for an offer, Meta passes the details you submit to us, typically your name, email address and phone number, together with your answers to the form.
Social media interactions. If you follow, message, comment on or tag our Facebook or Instagram pages, we can see your public profile name and what you send or post to us.
Marketing preferences. If you sign up to receive offers or news from us, or allow browser notifications on our website, we record your choice and the contact details or notification token needed to reach you.
3. Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Handling allergy and dietary requirements | Your explicit consent |
| Answering your questions and requests | Our legitimate interest in responding to customers, or steps you ask us to take before a contract |
| Assessing job applications | Steps you ask us to take before entering into an employment contract |
| Processing payments and keeping accounting and tax records | Performance of a contract and compliance with our legal obligations |
| Website analytics and measuring how visitors use our site | Your consent, given through our cookie banner |
| Showing you our ads on Facebook and Instagram, measuring their performance and building audiences (including through the Meta Pixel) | Your consent, given through our cookie banner |
| Following up on a lead form you submitted through our ads | Your consent, given when you submit the form, and steps you ask us to take |
| Sending you offers and news by email, SMS, WhatsApp or push notification | Your consent, which you can withdraw at any time |
| Keeping our website and systems secure and preventing fraud | Our legitimate interest in protecting our business and customers |
4. Cookies, analytics and the Meta Pixel
Our website uses essential cookies to work properly. With your consent it also uses analytics and advertising technologies, including Google Analytics (provided by Google Ireland Limited) and the Meta Pixel (provided by Meta Platforms Ireland Limited).
The Meta Pixel is a small piece of code that records actions you take on our website, such as viewing our menu or contacting us, and shares them with Meta. This lets us measure how well our ads work, show our ads to people who have visited our website, and reach people with similar interests. Meta may link this information to your Facebook or Instagram account and use it in line with its own Privacy Policy. For the collection and transmission of this data to Meta, we and Meta Platforms Ireland Limited are joint controllers; Meta is responsible for its own processing after it receives the data.
These technologies only run if you click “I agree” on our cookie banner. If you choose “Only essentials”, they are not loaded. You can change your mind at any time by clearing cookies for our website and choosing again, and you can manage your ad preferences in your Facebook and Instagram settings under Ad preferences. More detail is in our Cookie Policy.
5. Our Facebook and Instagram pages
When you visit our Facebook or Instagram pages, Meta collects data about your visit and provides us with anonymous statistics (“Page Insights”) about how people use our pages. For Page Insights, we and Meta Platforms Ireland Limited are joint controllers under an agreement set by Meta, the Page Insights Controller Addendum. Meta is primarily responsible for this processing, and you can exercise your rights directly with Meta.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers who help us run our business, under contracts that require them to protect it and use it only on our instructions, and with others where the law requires it. These include:
- Odoo — the software platform that runs our website, point of sale and business systems
- Viva.com — card payment processing
- Bolt Food — if you order delivery through Bolt Food, Bolt shares with us the order details we need to prepare your food; Bolt handles your account, payment and delivery under its own privacy policy
- Google — website analytics
- Meta Platforms Ireland Limited — advertising, lead forms, the Meta Pixel, and messaging on Facebook, Instagram and WhatsApp
- Carabao Limited — our IT and systems support provider, which may access data when maintaining our systems
- Our accountants, auditors and legal advisers, and public authorities such as the Commissioner for Revenue where we are legally required to share information
7. International transfers
Some of our providers, such as Google and Meta, may process data outside the European Economic Area, including in the United States. Where this happens, the transfer is protected by an appropriate safeguard, such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
8. How long we keep your data
- Allergy and dietary notes: for as long as needed to serve you, and deleted on request.
- Contact messages: up to 2 years after we last hear from you.
- Job applications: up to 6 months after the position is filled, unless you agree to us keeping them longer for future openings.
- Lead form submissions: up to 12 months after we last contact you, unless you become a customer or subscribe to our offers.
- Marketing contacts: until you unsubscribe or withdraw consent.
- Accounting and tax records: as long as Maltese law requires, generally up to 10 years.
- Website analytics data: according to the retention settings of Google Analytics and Meta, which we keep at the shortest period that meets our needs.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to our use of your data, including for direct marketing at any time;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting processing that took place before you withdrew it.
To exercise any of these rights, email info@pinoystreetfood.eu. We will reply within one month. We may ask you to confirm your identity before acting on your request.
10. How to ask us to delete your data
You can ask us to delete the personal data we hold about you, including data we received through Facebook or Instagram lead forms or messages, by emailing info@pinoystreetfood.eu with the subject “Data deletion request” and the name, email address or phone number you used with us. We will confirm once your data has been deleted, except for any records we must keep by law, such as accounting records. To remove data held by Meta itself, use the settings in your Facebook or Instagram account.
11. Complaints
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC) in Malta: idpc.org.mt, Floor 2, Airways House, High Street, Sliema SLM 1549, Malta.
12. Security
We use appropriate technical and organisational measures to protect your data, including access controls, encrypted connections to our website, and limiting access to staff who need it for their work.
13. Children
Our website and advertising are not directed at children under 16, and we do not knowingly collect their personal data online. If you believe a child has given us personal data, please contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated shown at the top.